CVE-2026-76519: Cisco Secure Email Gateway RCE

CVE-2026-76519 is a critical, unauthenticated arbitrary file-write vulnerability in the Advanced Malware Protection (AMP) attachment-scanning feature of Cisco Secure Email Gateway, triggered by a crafted email attachment, that can lead to root command execution on the device, and Cisco PSIRT confirmed active exploitation in October 2026.

CVE-2026-76519 is a vulnerability (CWE-23, relative path traversal) in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. NVD's description states it is "due to improper handling of email attachments when the file reputation service is enabled" and that "an attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device," with a successful exploit allowing the attacker "to write arbitrary files and execute commands with root privileges on the underlying operating system" (NVD).

NVD lists the vulnerability status as "Analyzed" with a CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a required-action due date of 2026-10-17, confirming the vulnerability is being actively exploited (CISA KEV).

Cisco's own advisory (cisco-sa-esa-afw-zqYJkjxp) lists AsyncOS for Secure Email Gateway as affected across 15.5 releases before 15.5.5-014, all 16.0 releases, and 16.5 releases before 16.5.0-780, states "there are no workarounds that address this vulnerability," and confirms "in October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." The fix requires upgrading to AsyncOS 15.5.5-014 or 16.5.0-780 together with Content Scanner Tools 25.3.0.5525 or later (Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.01573 (75.185th percentile) — elevated for a vulnerability only days past disclosure, consistent with the confirmed in-the-wild activity (FIRST EPSS).

Because no workaround exists and exploitation is confirmed, any Cisco Secure Email Gateway appliance with AMP/file-reputation scanning enabled on an affected AsyncOS build should be patched immediately, with logs reviewed for signs of prior exploitation.

• Unauthenticated, remote arbitrary file write in the AMP feature of Cisco Secure Email Gateway via a crafted email attachment, enabling root command execution. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; NVD status is "Analyzed". — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-14, due date 2026-10-17. — CISA KEV
• Affects AsyncOS 15.5 before 15.5.5-014, all 16.0 releases, and 16.5 before 16.5.0-780; no workarounds exist; fixed in AsyncOS 15.5.5-014/16.5.0-780 plus Content Scanner Tools 25.3.0.5525+; Cisco PSIRT confirmed active exploitation in October 2026. — Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp
• EPSS score is 0.01573 (75.185th percentile) as of 2026-10-21. — FIRST EPSS